Exchange and Autodiscover

Using the Exchange Management Console you configure the Client Access Server, or you use the Exchange Management Shell using the following commands.

Set-OWAVirtualDirectory –Identity ServerName\OWA (default web site) -ExternalURL https://webmail.inframan.nl/OWA

Set-OABVirtualDirectory –Identity ServerName\OAB (default web site) -ExternalURL https://webmail.inframan.nl/OAB

Set-WebServicesVirtualDirectory –Identity ServerName\EWS (default web site) -ExternalURL https://webmail.inframan.nl/ews/exchange.asmx

Set-ActiveSyncVirtualDirectory –Identity X2007SRV\Microsoft-Server-ActiveSync (default web site) -ExternalURL https://webmail.inframan.nl/Microsoft-Server-ActiveSync

If you are running Exchange Server 2010, this setting is needed as well:

Set-ECPVirtualDirectory –Identity 2010CAS\ECP (default web site) -ExternalURLhttps://webmail.inframan.nl/EC


Reference:
http://www.msexchange.org/articles_tutorials/exchange-server-2010/management-administration/exchange-autodiscover-part2.html
Now these are for the External URL. When Outlook connects to the Client Access Server it determines whether it is an internal or an external connection. So we also have to configure the internalURL property.

By default the internalURL is configured with the local servername, like https://ServerName.e2010.local/OAB, for example.

This is caused by the fact that the internal server name is returned from the SCP. The Outlook client tries to access this internal servername using HTTPS (remember it is a web service after all) but the internal name is not in the certificate.

You can solve this by changing the internalURL property with the value of the externalURL. You can do this using the Exchange Management Console and changing the properties of the Client Access Server:

You can also use the Exchange Management Shell to change these settings by entering the following commands:

Set-OWAVirtualDirectory –Identity X2007SRV\OWA (default web site) -InternalURL https://webmail.inframan.nl/OWA

Set-OABVirtualDirectory –Identity X2007SRV\OAB (default web site) -InternalURL https://webmail.inframan.nl/OAB

Set-WebServicesVirtualDirectory –Identity X2007SRV\EWS (default web site) -InternalURL https://webmail.inframan.nl/ews/exchange.asmx

Set-ActiveSyncVirtualDirectory –Identity X2007SRV\Microsoft-Server-ActiveSync (default web site) -InternalURL https://webmail.inframan.nl/Microsoft-Server-ActiveSync

And again, this setting is only valid for Exchange Server 2010:

Set-ECPVirtualDirectory –Identity 2010CAS\ECP (default web site) -InternalURLhttps://webmail.inframan.nl/ECP

Now the Client Access Server will always use the external URL webmail.inframan.nl, whether the request comes from the internal network or from the outside (the Internet).

DNS

How do you prevent internal Outlook clients to connect to the Internet (i.e. webmail.inframan.nl) instead of the internal side of the Client Access Server? Normally webmail.inframan.nl resolves to 83.161.229.15, but internally you want it to resolve to internal address, for example to 10.0.0.207 which is the internal IP address of the Client Access Server.

To accomplish this you have to implement something which is known as ‘split DNS’. Besides the external DNS, you create an internal DNS zone named ‘inframan.nl’ and point the servers to the internal servers. In this case both the webmail.inframan.nl and the autodiscover.inframan.nl are resolved to 10.0.0.207 instead of 83.161.220.15

So, you have configured everything the way you want it to be, but still you get this error message as shown in Figure 1. It is a certificate warning, so you can check the IIS Log File on the Client Access Server.

Outlook 2007/2010 checks the autodiscover configuration every 15 minutes for changes in the infrastructure. And again you have the InternalURL property. But this time it’s not on the Autodiscover Virtual Directory. When you check the Autodiscover Virtual Directory details you’ll see that both the InternalURL as well as the ExternalURL property are empty:



Changing these properties doesn’t have the desired effect. For changing the internalURL settings you have to modify the Client Access Server properties. Enter the following command in an Exchange Management Shell:

Get-ClientAccessServer –Identity X2007SRV | Set-ClientAccessServer
–AutodiscoverServiceInternalUrihttps://autodiscover.inframan.nl/autodiscover/autodiscover.xml

Everything should be fine now.

CAS ARRAY

And what role does the CAS Array play in the Autodiscover story? The CAS Array is implemented when you have multiple Client Access Servers in a load balanced scenario. Outlook clients connect to a Client Access Server instead of a Mailbox Server for retrieving Mailbox information. This is achieved using the RPC protocol and not using the HTTPS protocol. Think about Outlook 2003 which doesn’t use HTTPS at all. The CAS Array is also used as a ‘backlink’ from the Mailbox Databases to the Client Access Servers. Mailbox Databases have a RPCClientAccessServer property which links a Mailbox Database to a CAS Server. This is also based on the RPC protocol.

The first step is to create a NLB cluster on your Client Access Server and give the cluster a name, for example nlb.labs.local. If you are using Client Access Servers running on Hyper-V (or VMWare) you have to be aware of the MAC address issue. Hyper-V has a range of MAC addresses being used by Virtual Machine. When you create an NLB cluster a random MAC address for the NLB address is generated, and this MAC address is not recognized by the Hyper-V Servers. More information on how to configure this can be found in Microsoft knowledge base article 953828.
Now you can add the CAS Array to the Exchange configuration, and the only option is to use the Exchange Management Shell. Enter the following command:

New-ClientAccessArray -FQDN webmail.inframan.nl -Name CAS_Arrary

The CAS Array will be added to the Exchange configuration, and it Fully Qualified Domain Name is “webmail.inframan.nl”. Your Outlook clients can now use “webmail.inframan.nl” as the Exchange Server using RPC.

Newly created Mailbox Databases will use the CAS Array as the RPC Proxy, but existing Mailbox Database will use the individual Client Access Servers as the RPC Proxy. To change the –RPCClientAccessServer property on all Mailbox Database in one time, open the Exchange Management Shell and enter the following command:

Get-MailboxDatabase | Set-MailboxDatabase –RPCClientAccessServer “webmail.inframan.nl”